https://bugzilla.redhat.com/show_bug.cgi?id=2135229
Bug ID: 2135229 Summary: CVE-2021-36369 <net-misc/dropbear-2022.82: forwarded agent abuse Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: high Priority: high Assignee: security-response-team@redhat.com Reporter: mrehak@redhat.com CC: buytenh@wantstofly.org, cickumqt@gmail.com, daniellarasouza@yahoo.com.br, epel-packagers-sig@lists.fedoraproject.org Target Milestone: --- Classification: Other
Due to a non-RFC-compliant check of the available authentication methods in the client-side SSH code, it is possible for an SSH server to change the login process in its favor. This attack can bypass additional security measures such as FIDO2 tokens or SSH-Askpass. Thus, it allows an attacker to abuse a forwarded agent for logging on to another server unnoticed.
Reference:
https://github.com/mkj/dropbear/pull/128 https://github.com/mkj/dropbear/releases/tag/DROPBEAR_2022.82 https://github.com/mkj/dropbear/releases
https://bugzilla.redhat.com/show_bug.cgi?id=2135229
Marian Rehak mrehak@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |2135231, 2135230
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=2135230 [Bug 2135230] CVE-2021-36369 dropbear: <net-misc/dropbear-2022.82: forwarded agent abuse [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2135231 [Bug 2135231] CVE-2021-36369 dropbear: <net-misc/dropbear-2022.82: forwarded agent abuse [epel-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2135229
--- Comment #1 from Marian Rehak mrehak@redhat.com --- Created dropbear tracking bugs for this issue:
Affects: epel-all [bug 2135231] Affects: fedora-all [bug 2135230]
https://bugzilla.redhat.com/show_bug.cgi?id=2135229
--- Comment #2 from Product Security DevOps Team prodsec-dev@redhat.com --- This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.
https://bugzilla.redhat.com/show_bug.cgi?id=2135229
Product Security DevOps Team prodsec-dev@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |UPSTREAM Status|NEW |CLOSED Last Closed| |2022-11-29 20:27:59
https://bugzilla.redhat.com/show_bug.cgi?id=2135229 Bug 2135229 depends on bug 2135230, which changed state.
Bug 2135230 Summary: CVE-2021-36369 dropbear: <net-misc/dropbear-2022.82: forwarded agent abuse [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2135230
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |EOL
https://bugzilla.redhat.com/show_bug.cgi?id=2135229 Bug 2135229 depends on bug 2135231, which changed state.
Bug 2135231 Summary: CVE-2021-36369 dropbear: <net-misc/dropbear-2022.82: forwarded agent abuse [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2135231
What |Removed |Added ---------------------------------------------------------------------------- Status|ON_QA |CLOSED Resolution|--- |ERRATA
epel-packagers-sig@lists.fedoraproject.org
-
bugzilla＠redhat.com